---

id: 76

slug: "pem-encoding"

title: "PEM encoding/decoding"

category: "security"

difficulty: "advanced"

jdkVersion: "25"

oldLabel: "Java 8"

modernLabel: "Java 25 (Preview)"

oldApproach: "Manual Base64 + Headers"

modernApproach: "PEM API"

oldCode: |-

String pem = "-----BEGIN CERTIFICATE-----\n"

+ Base64.getMimeEncoder()

.encodeToString(

cert.getEncoded())

+ "\n-----END CERTIFICATE-----";

modernCode: |-

// Encode to PEM

String pem = PEMEncoder.of()

.encodeToString(cert);

// Decode from PEM

var cert = PEMDecoder.of()

.decode(pemString);

summary: "Encode and decode PEM-formatted cryptographic objects natively."

explanation: "The PEM API provides standard encoding/decoding for certificates, keys,\

\ and other cryptographic objects in PEM format. No more manual Base64 wrapping\

\ with BEGIN/END headers."

whyModernWins:

- icon: "🧹"

title: "No manual Base64"

desc: "PEM headers, line wrapping, and Base64 handled automatically."

- icon: "🔄"

title: "Bidirectional"

desc: "Encode to PEM and decode from PEM with one API."

- icon: "🛡️"

title: "Standard format"

desc: "Produces RFC 7468-compliant PEM output."

support:

state: "preview"

description: "Preview in JDK 25 (JEP 470). Requires --enable-preview."

prev: "datetime/hex-format"

next: "security/key-derivation-functions"

related:

- "security/key-derivation-functions"

- "security/strong-random"

- "security/tls-default"

docs:

- title: "PEM Encodings of Certificates (JEP 470)"

href: "https://openjdk.org/jeps/470"